Description
Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in FPLoginExt in login in etc/uams/uams_pam.c. 2.4.1 and 3.1.19 are also fixed versions.
References (5)
Core 5
Core References
Broken Link, Not Applicable
https://github.com/Netatalk/netatalk/issues/1096
Exploit, Vendor Advisory
https://github.com/Netatalk/netatalk/security/advisories/GHSA-8r68-857c-4rqc
Patch, Vendor Advisory
https://netatalk.io/security/CVE-2024-38439
Scores
CVSS v3
9.8
EPSS
0.0053
EPSS Percentile
67.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-787
Status
published
Products (2)
netatalk/netatalk
3.2.0
netatalk/netatalk
2.0.0 - 2.4.1
Published
Jun 16, 2024
Tracked Since
Feb 18, 2026